Ancilla-Driven Universal Blind Quantum Computation 
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Blind quantum computation is a new quantum secure protocol, which enables Alice who does not 
have enough quantum technology to delegate her computation to Bob who has a fully-fledged quan- 
tum power without revealing her input, output and algorithm. So far, blind quantum computation 
has been considered only for the circuit model and the measurement-based model. Here we consider 
the possibility and the limitation of blind quantum computation in the ancilla- driven model, which 
is a hybrid of the circuit and the measurement-based models. 



I. INTRODUCTION 

Traditionally, quantum computation has been stud- 
ied in the circuit model QJ, where the quantum regis- 
ter which stores quantum information consists of many 
qubits, and a quantum gate operation is performed by 
directly accessing one or two qubits in the quantum reg- 
ister. Another canonical model of quantum computation 
is the one-way model Q (or more general measurement- 
based models [3l4l3^). where the universal quantum com- 
putation is performed by adaptive local measurements on 
a highly entangled resource state. Recently, a mixture 
of those two models, which is called the ancilla- driven 
quantum computation, was proposed in [3, EH- In this 
model, the quantum register is a set of many qubits like 
the circuit model, whereas a quantum gate operation is, 
like the one-way model, performed by adaptive local mea- 
surements: one or two register qubits are coupled to a 
single mobile ancilla, and the ancilla is measured after 
establishing the interaction between the ancilla and reg- 
ister qubit(s). The backaction of this measurement pro- 
vides the desired gate operation, such as a single qubit 
rotation or an entangling two-qubit operation, on register 
qubit (s). In the ancilla-driven model, the universal quan- 
tum computation is performed with only a single type of 
interaction (CZ or SWAP+CZ) between the ancilla and 
register qubit (s). It is a great advantage for experiments, 
since in many experimental setups, implementing various 
different types of interactions at the same time is very 
difficult (such as the solid-based quantum computation). 
Furthermore, the roles of the register and the information 
carrier are clearly separated, and no direct action on the 
register is required. Therefore, it is also useful for exper- 
imental systems where measurements destroy quantum 
states, such as photonic systems. In short, this model 
is a natural theoretical model of the "hybrid quantum 
computer" where the flying ancilla mediates interactions 
between static qubits (such as the chip-based quantum 



computation [16|, 17 1 or the hybrid system of matter and 



optical elements 

In a future when a scalable quantum computer is 
realized, the quantum computation should be done in 
the "cloud" style, since only limited number of people 



would have enough money and technology to create and 
maintain quantum computers. Blind quantum computa- 
tion |20l429| ensures the privacy of the client in such a 
cloud quantum computing. In protocols of blind quan- 
tum computation, Alice, the client, does not have enough 
quantum technology. On the other hand, Bob, the server, 
has a fully- fledged quantum power. Alice asks Bob to 
perform her computation on his quantum computer in 
such a way that Bob cannot learn anything about her in- 
put, output, and algorithm. Blind quantum computation 
was initially considered by using the circuit model [20I — 
l22j . However, in this case, Alice needs a quantum mem- 
ory. Recent new ideas of blind quantum computation 
which use measurement-based models have succeeded to 
exempt Alice from a quantum memory [23l-[29|. 

In terms of the computational power, measurement- 
based models do not offer any advantage over the cir- 
cuit model, since the circuit model can be simulated 
by measurement-based models and vice versa. However, 
measurement-based models have provided new points of 
view for studying quantum computation, and in fact 
such new viewpoints have enabled plenty of successes 
which have never been done in the circuit model, such as 
the high-threshold fault-tolerancy flol-[l2[ [30l436| , clar- 
ifying roles of entanglement played in quantum com- 
putation |3l l37l - [4Ql , and relations to condensed-matter 
physics [Jh, Qjl l4ll - [44{ . Therefore it is important to ex- 
plore the possibility of blind quantum computation on 
other models than the circuit model and measurement- 
based models. 



II. PRELIMINARIES 

We first define several notations for the bases and for 
the basic transformations as follows. 
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We conventionally use the notations {|=b)} and {|0),|1)} 
to denote the bases along X and Z axes in Bloch sphere, 
respectively. Measurement outcome is represented by 
s G {0, 1}, associated with ±. We denote by si the zth 
measurement outcome. 



III. ANCILLA-DRIVEN QUANTUM 
COMPUTATION 

We review the ancilla-driven quantum computation 
(ADQC) model proposed in [l5|. ADQC is performed 
with (a single or a few) entangle operator (s) E as . As 
in Fig OJ (a), E as can be decomposed into E as = (W s 
W f a )D as {V s ®V^), where V a ,V£, W s and W' a are local uni- 
taries and D as is a non-local unitary, by the Cartan de- 
composition [45j. FigJT]-(a) can be rewritten to FigJT}(b) 
by applying V a to the initial ancilla state |+) a and W' a to 
the measurement basis {|0),|1)}. D as is described as 

H — „-i(ot x X a ®X 3 +a y Y a ®Y 3 +a z Z a ®Z 3 ) 
is as — f 

by using non-symmetric parameters < a x ,a y ,a z < j 



due to the Weyl chamber [46 
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FIG. 1. ADQC model. Rectangle boxes with bold line repre- 
sents measurements and the inside represents bases for the mea- 
surements. 

For universal quantum computation, we should choose 
all the parameters appropriately. To this end, Anders 
et al. in [15| derive sufficient conditions for (i) Unitar- 
ity, (ii) One-step Correctable Branching, (iii) Standard- 
ization and (iv) Universality. Especially, we will discuss 
about One-step Correctable Branching, which states that 
the generalized Pauli correction (according to the mea- 
surement outcome) after "one" execution of the operation 
in Fig.l-(b) enables the Kraus operator acting on the sys- 
tem deterministic. In order to fulfill these conditions, it 
is shown that the entangle operator E as must be locally 
equivalent to either SWAP+CZ or CZ . 



IV. ANCILLA-DRIVEN UNIVERSAL BLIND 
QUANTUM COMPUTATION 

SWAP+CZ type can be considered as an extension of 
one-way quantum computation, so we can actually per- 
form universal blind computation as in [23|. Therefore 
we only investigate universal blind computation of CZ 
type. Requiring the above four conditions is too strong 
for the blind ADQC model of CZ type. Actually, we have 
the following. 



Theorem 1. ADQC of CZ type satisfying all the condi- 
tions from (i) to (iv) cannot be universal blind quantum 
computation (in the sense of fj3/). 

Proof. The system Kraus operator for E as is specified 
as an excepted local unitaries Kf = a (±o j(p \D as |+ 7j <j) a . 
As in [15j, conditions for Unitarity and One-step Cor- 
rectable Branching require that the parameters for an- 
cilla satisfy sin cos 7 sin <fi = cos sin 7 sin 5 and Kraus 
operator Kf = f±I + i(— l) n± g±X Sl where n± are inte- 
gers that differ in the parity. Each coefficient is rewritten 
as follows: 



f± = 22 7r =*= cqs 7 CQS A ± sin 7 s ^ n A cos(£ ~ 0) 
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Therefore, all the conditions from (i) to (iv) imply that 
admissible parameters of ancilla are classified into the 
following four cases. 
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Kraus operator 
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For "universal" blind computation, a rotation operator, 
e.g., R x (0) is necessary. Thus, we have only to consider 
the second case. In that case, the initial state of the an- 
cilla should be fixed to |0) since 7 = 0. This means that 
we cannot rotate the initial state to make the computa- 
tion blind. □ 

From the above, we consider to disregard the One-step 
Correctable Branching condition and derive some more 
admissible parameters of ancilla as follows. 



initial state 


measurement basis 


Kraus operator 


7 = any, 5 = 


= any, <j> = 


Kf = cos(^)/ - 2sin(^)X 
K~ =sin(^)/-icos(^)X 


7, S = any 


= ^^ = 8 


Kf = I — i sin 7 cos SX 
Kf = (i sin 6 — cos 7 cos S)X 



In addition, we consider to relax One-step Correctable 
Branching to Multiple-step and provide a sufficient con- 
dition which can make ADQC of CZ type blind. 

Theorem 2 (sufficient condition for the blindness). In 
ADQC model, if universal quantum computation satisfies 
all the following conditions, we can make the computation 
blind, where Condition 3' is alternative to Condition 3. 
In the following, rotations are with respect to X,Y or Z 
axes in Bloch sphere. 

1. Rotation R{£) can be simulated with measurement 
basis parameter £. This unitary can be described as 
WR(tf)V up to Pauli correction, where V and W 
are Clifford operators. 
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2. Rotation R'((p) can be simulated with initial state 
parameter ip. This unitary can be described as 
W'R'((-l) 8 ip)V, where V andW are Clifford op- 
erators and s is an outcome of the measurement in 
this simulation so the unitary is not correctable. 

3. With respect to unitaries simulated in Conditions 1 
and 2, the following equation holds: 

WR(£)VW'R'((p)V = WR(i')VW'V' d = S, 
where = £ + (—l) n cp and n is an integer number. 

3' Clifford operator E up to Pauli correction can be 
simulated. With respect to unitaries simulated in 
Conditions 1 and 2, the following equation holds: 

WR(i)VEW f R f (ip)V' = WR{£')VEW'V d = S' , 
where £' = £ + (— l) n <p and n is an integer number. 

4 A gate pattern which can perform both U ®U' , ten- 
sor product of any one-qubit unitaries U and U' , 
and one kind of two-qubit unitaries is composable 
by using an unitary S (or S' ), an entangle operator 
or a controlled- Pauli that can be simulated. 

Proof. We can perform an arbitrary quantum computa- 
tion by tiling the gate pattern in Condition 4 regularly 
as in Figj2j What unitaries the gate pattern performs 
depends on a parameter £' of each gate in Condition 3 
(or 3') composing the gate pattern. When Client chooses 
a parameter Client sends a measurement basis pa- 
rameter £ such that £ = £ / — (— l) n ^- By choosing an 
initial state parameter ip randomly, £ also looks random 
to Server. This process is performed similarly to the 
protocol in [23|. We use the following protocol for the 
simulation of S (or S'). 

1. Client chooses a parameter ip of ancilla randomly 
and sends the ancilla to Server. 

2. Server performs the simulation of W' R{ip)V with 
the given ancilla. (The simulation of E is optional.) 
Server sends the outcome (s) of the measurement in 
this simulation to Client. 

3. Client decides £' and calculates £ = — (— l) n (p+r7r 
with a random bit r G {0, 1} then sends £ to Server. 

4. Server performs the simulation of WR(£)V and 
sends a bit b as the outcome of the measurement in 
this simulation to Client. 

5. Client inverts the bit value b if r = 1. 



In this protocol, each ancilla state is maximally mixed 
state and each £ looks random to Server. Therefore, the 
information leaked to Server is only the size of the uni- 
versal gate pattern, that is, the input size and the depth 
of the computation. □ 

For satisfying Conditions 2 and 3 stated in Theorem 
2, we have that the Kraus operators are written as 

K = Rxti) and K~ = R x (-j - ir) 

if we choose the initial state parameters 7 be any value 
and 6 = and the measurement bases parameters 0, 6 = 
0. Then, we have the following. 

Theorem 3. Condition 3 and 4 do not hold simultane- 
ously if we can use only one kind of entangle operators. 

Proof. From Condition 3 for the blindness, it must 
hold that WR x (6)VWR x ((-l) s ip)V = WR x (0 + 
(-l) n (p)VWV. These V and W are denoted as al + ibX 
or aY + bZ, up to the global phase, where a, b G R. So, 
any unitary U composed of W R x (0)VW R x ((—l) s (p)V is 
described U = WUV with the kernel U which moves a 
quantum state only in one plane of Bloch sphere, par- 
allel to the Y-Z plane. If V and W are determined, U 
becomes an unitary which moves a quantum state only 
in one plane of Bloch sphere so we cannot perform any 
arbitrarily rotation U (8) U' in Condition 4. Therefore we 
cannot satisfy Conditions 3 and 4 simultaneously. □ 
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FIG. 3. Simulating HR Z {^') and CZ. 
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FIG. 4. Gate pattern (a) is for a single entangle operator and (b) 
for two entangle operators. 
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FIG. 2. Universal gate pattern. 



Theorem 4. Conditions 3 f and 4 can hold simultane- 
ously if we use one kind of entangle operators. 

Proof. It is enough to show a way of simulations and 
a gate pattern. The simulation in Condition 3 and a 
controlled-Pauli in Condition 4 are shown in Figj3j A 
gate pattern in Condition 4 is shown in Fig0]-(a). □ 



Theorem 5. Conditions 3 and 4 can hold simultaneously 
if we use two kinds of entangle operators. 

Proof It is enough to show a way of simulations and a 
gate pattern. The simulation in Condition 3 is shown 
in Fig|5] and a gate pattern in Condition 4 is shown in 
FigH(b). □ 



Corollary 1. Universal blind computation in ADQC 
model is possible since we can satisfy the sufficient con- 
dition for the blindness. 



V. CONCLUSION 

In this paper, we considered the limitation and possi- 
bilities for universal blind computation in ADQC model. 
First, we proved that if we satisfy all the conditions for 



universal quantum computation in [15] . we can not per- 
form universal blind computation. Therefore, we relaxed 
some conditions and derived a sufficient condition for the 
blindness. Finally, we provided a way of universal blind 
computation in ADQC model. 
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